#pragma once

#include <string>
#include <vector>
#include <map>
#include <seccomp.h>

namespace judge {

class SeccompFilter {
public:
    SeccompFilter(const std::string& language,
                 const std::vector<std::string>& allowed_syscalls,
                 const std::map<std::string, std::map<unsigned int, uint64_t>>& restricted_syscalls);
    ~SeccompFilter();

    // 加载并应用过滤器
    void load();

private:
    void setupBasicRules();
    void setupLanguageSpecificRules();
    void setupFileAccessRules();
    void setupNetworkRules();

    scmp_filter_ctx ctx_;
    std::string language_;
    std::vector<std::string> allowed_syscalls_;
    std::map<std::string, std::map<unsigned int, uint64_t>> restricted_syscalls_;
};

} // namespace judge 